Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (2).zip
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
initial sample
|
 |
|
|
C:\Users\user\Downloads\1vSHfzz0.exe'%20during%20a%20scheduled%20scan.part
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Downloads\virut' in file 'Setup.exe' during a scheduled scan (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41
|
ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs-1.js
|
ASCII text, with very long lines (1717), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js (copy)
|
ASCII text, with very long lines (1717), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionCheckpoints.json (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\sessionCheckpoints.json.tmp
|
JSON data
|
dropped
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://detectportal.firefox.com/canonical.html
|
34.107.221.82
|
||
|
http://detectportal.firefox.com/success.txt?ipv4
|
34.107.221.82
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
example.org
|
23.215.0.132
|
||
|
prod.classify-client.prod.webservices.mozgcp.net
|
35.190.72.216
|
||
|
prod.balrog.prod.cloudops.mozgcp.net
|
35.244.181.201
|
||
|
prod.detectportal.prod.cloudops.mozgcp.net
|
34.107.221.82
|
||
|
ipv4only.arpa
|
192.0.0.171
|
||
|
prod.ads.prod.webservices.mozgcp.net
|
34.117.188.166
|
||
|
push.services.mozilla.com
|
34.107.243.93
|
||
|
prod.remote-settings.prod.webservices.mozgcp.net
|
34.149.100.209
|
||
|
contile.services.mozilla.com
|
34.117.188.166
|
||
|
prod.content-signature-chains.prod.webservices.mozgcp.net
|
34.160.144.191
|
||
|
spocs.getpocket.com
|
unknown
|
||
|
detectportal.firefox.com
|
unknown
|
||
|
content-signature-2.cdn.mozilla.net
|
unknown
|
||
|
firefox.settings.services.mozilla.com
|
unknown
|
||
|
shavar.services.mozilla.com
|
unknown
|
There are 5 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
35.244.181.201
|
prod.balrog.prod.cloudops.mozgcp.net
|
United States
|
||
|
34.117.188.166
|
prod.ads.prod.webservices.mozgcp.net
|
United States
|
||
|
44.242.27.200
|
unknown
|
United States
|
||
|
35.190.72.216
|
prod.classify-client.prod.webservices.mozgcp.net
|
United States
|
||
|
34.160.144.191
|
prod.content-signature-chains.prod.webservices.mozgcp.net
|
United States
|
||
|
127.0.0.1
|
unknown
|
unknown
|
||
|
34.107.221.82
|
prod.detectportal.prod.cloudops.mozgcp.net
|
United States
|